Privacy policy
Template: this text has not yet been reviewed by a lawyer and contains open points.
1. Controller
Vduce Technology UG (haftungsbeschränkt)
Heinrich-Böll-Str. 89
68766 Hockenheim
Germany Email: info@vduce.com · Phone: +49 176 84989422
Data protection officer: not appointed, as there is no obligation under § 38 BDSG.
2. Overview
We process personal data only as far as necessary to run this website, answer your enquiries and prepare projects. This website sets no tracking cookies. External content (maps, booking) only loads after you agree.
3. Hosting and server log files
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit, Vercel processes technically necessary data (IP address, date and time, page requested, browser, referrer) in server logs to deliver the website securely. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). We have a data processing agreement with Vercel; transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses.
4. Cookieless analytics (Vercel Web Analytics)
We use Vercel Web Analytics to understand which pages are used and which forms are submitted (for example "form step completed" or "app estimator completed"). No cookies are set and no personal profiles are created; visitors are recognised by a hash that changes daily and cannot identify you. Legal basis: Art. 6(1)(f) GDPR.
5. Contact and project enquiries
When you contact us through a form (project brief, quick contact, demo request, app estimator, AI readiness check), by email, phone or WhatsApp, we process your details (name, email, company, phone, message, your answers, any uploaded files) to handle your enquiry. We also store which page you came from, campaign UTM parameters, the referrer and your language so we can route the enquiry correctly. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) and Art. 6(1)(f) GDPR (legitimate interest in handling enquiries).
Storage: enquiries are stored in our content management system Sanity (Sanity AS, Oslo, Norway; partly processed in the USA under standard contractual clauses). Only authorised staff have access.
Email: notifications to us and the confirmation to you are sent through Resend (Resend Inc., USA; data processing agreement, standard contractual clauses).
CRM: optionally we forward enquiries to our CRM [CONFIRM: provider, e.g. HubSpot / Pipedrive / Brevo].
Retention: enquiries that do not lead to a contract are deleted no later than 24 months after the last contact [CONFIRM]. If a contract follows, statutory retention periods apply (up to 10 years under German commercial and tax law).
UTM parameters: campaign parameters from your landing URL are kept in your browser's sessionStorage so they can be attached to a later enquiry. They are deleted when you close the tab and only sent if you submit a form.
6. Spam protection (Cloudflare Turnstile)
To protect our forms from automated abuse we use Cloudflare Turnstile (Cloudflare Inc., USA). Turnstile checks technical properties of your browser to confirm that a human is submitting, without advertising cookies. Legal basis: Art. 6(1)(f) GDPR. Transfers to the USA rely on the EU-US Data Privacy Framework.
7. Booking a call (Cal.com)
To book a call we embed Cal.com (Cal.com Inc., USA). The booking widget only loads after you explicitly agree (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Alternatively, open the link in a new tab or email us. [CONFIRM: provider Cal.com or Calendly]
8. Maps (Google Maps)
On the contact page you can load a map of our offices from Google Maps (Google Ireland Ltd., Dublin). The map loads only after you click (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Your browser then sends data to Google, including to the USA.
9. Consent and local storage
We store your choice about external content in your browser's localStorage (key "vduce-consent") so you are not asked on every visit. You can change it at any time via "Cookie settings" in the footer. This is technically necessary (§ 25(2) TDDDG).
10. Fonts
All fonts are served from our own server. There is no connection to Google Fonts.
11. Job applications
Applications you email us are processed to run the application process (§ 26 BDSG, Art. 6(1)(b) GDPR) and deleted six months after the process ends unless you agree to longer storage.
12. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and you can withdraw consent at any time. You may lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
13. Last updated
November 2026. [CONFIRM: legal review]